Académique Documents
Professionnel Documents
Culture Documents
BRYAN SCHRODER
Unitcd Statcs Attorlley
ADAM ALEXANDER
Assistant United States Attorney
Federal Building`と U.S.Courthouse
222 West 7th Avcnue,Rool■ 253
Anchorage,Alaska 99513‐ 7567
Phonc:(907)271-5071
Fax:(907)271-1500
gOV
Emぶ 1:adam.dexander@usd●・
Plaintift I PLEAAGREEMENT
VS. )
KENNETH SCHUCHMAN,
)
)
Defcndant.
)
'Ihe defendant agrees to plead guilty to the sole count of the Indictrnent in this
$$ 1030 and2. The United States agrees to recommend a sentence at the low end of the
guideline range as calculated and adopted by the court. The llnited States agrees not to
prosecute the defendant {i"rrther lbr any other off'ense related to the events that resulted in
The defendant will waive all rights to appeal the conviction and sentenoe imposed
under this agreement. The defendant will also waive all rights to collaterally attack the
conviction and sentence, except on the grounds of ineffective assistance of counsel or the
Unless the parties otherwise inform the Court in writing, Federal Rule of Criminal
Procedure l1(cXl)(A) and (B) will control this plea agreement. Thus, the det'endant may
not withdraw from this agreement or the guilty plea if the Court rejects the parties'
Indictment:
1030(a)(s)(A) and 2.
B. Elements
The elements of the charge in Count I to which the def'endant is pleading guilty
are as follows:
authorization; and
commerce or communication.
1030(aX5)(A); and
3. 'fhird, the defendant acted before the crirne was completed with the
l8 U.S.C. $ 1030(a)(5XA).
C. Factual Basis
The defendant admits the truth of the allegations in Count I of the Indictment and
the truth of the following statement. and the parties stipulate that the Court may rely upon
this statement to support the factual basis for the guilty plea and for the imposition of the
sentence:
("SCHUCHMAN"), agree that the following facts are true and correct, and that had this
matter proceeded to trial, the United States would have proven them beyond a reasonable
From at least on or about July 20l7 , and continuing through October 201 8, in the
Distriet of Alaska and elsewhere, SCHUCHMAN knowingly and intentionally caused the
Service (DDoS) Botnets, in violation of 'I-itle 18, United States Code, Section
1030(a)(5)(A) and (b), that is, SCHUCHMAN knowingly caused the transmission of a
program, information, oode, and command, and knowingly aided and abetted others in
doing the same and in attempting to do the same, and as a result of such conduct,
protected computer, and resulting in a loss of $5,000 or more in darnage affecting ten or
more protected computers during a one-year period, speoilically from August 1.2017
1. BACKGROUND
Distributed denial of service ("DDoS") attacks occur when multiple internet-
enabled devices act in unison to overwhelm the targeted devices. While there are many
different methodologies used to conduct DDoS attacks, the criminal intent is to generate
sufficient attack volume to overwhelm the capacity of the target device, rendering the
target device inaccessible for the duration of the attack. DDoS attacks of sufficient
volume can damage not only the intended target but also upstream internet service
DDoS attacks are often directed at servers that provide critical services to public
and private entities. including those that host websites, with the intent of causing
Individuals developing botnets to conduct DDoS attacks damagc at least two different
categories of victirn devices: victim devices that are hijacked and exploited to comprise
the botnet ("nodes") and victim devices that are the targets of the botnets DDoS attacks.
Criminals often target so-called Internet of Things (Io'l') devices such as home I)VRs,
internet routers, and smart camera systems. These devices are oan be subject to wide-
scale credential vulnerabilities that can permit criminal actors t<l exploit substantial
entered into a conspiracy spanning at least the period between July 2017 and October
developed criminal tools and techniques necessary to eft'ectively deploy botnets for the
purposes of conducting DDoS attacks. They gave these botnets names such as'oSatori,"
o'Masuta,"
and "Okiru." Over time, these botnets grew more complex and effective in
SCHUCHMAN and his co-conspirators did not have consent or pennission from
the owners of the victim devices compromising the botnet, and instead used an array of
complex means to compromise the devices in order to foroe them to partioipate in the
DDoS aftacks against targeted victims. While SCHUCITMAN and his co-conspirators
themselves conducted DDoS attacks using the botnets they developed. their prirnary
focus was monetizing their botnets by selling access to other criminal actors in order to
generate illicit proceeds. SCHUCHMAN and his co-conspirators received payment from
customers who rented access to their botnets to engage in additional criminal activity.
Those payments were made in cryptocurrency, such as Bitcoin, and other online
classes of victim devices for the purpose of compromising those devices at scale. f'hose
vulnerabilities often included default credential pairs such as userRames and passwords,
individual devices, but entire categories of devices sharing the same vulnerability.
From at least on or about July 28, 2017, and oontinuing through July 27,2018,
SCHUCHMAN and oo-oonspirators, who are not charged in this indictrnent, sold access
to an evolving series of DDoS botnets. Initially, the botnets were based largely on the
source code used lbr the Mirai botnet, which was the subject of a previous prosecution in
features and exploited new vulnerabilities during the course of their orirninal conspiracy.
nicknames "Vamp" and "I)rake," whose true identities are known to the United States.
Vamp served as thc primary developer and coder fcrr the botnet at this time. Drake
took the lead in managing the sales and customer support. SCHUCHMAN developed
and acquired exploits used to inf'ect new devices tbr the botnet and provided development
support. All three individuals and other currently uncharged co-conspirators took an
active role in aiding and abetting the criminal development and deployment of DDoS
botnets during this period for the purpose of hijacking victim devices and targeting
developmental botnets Satori. This version extended the Mirai DDoS botnet's
version of their Satori botnet to conduct DDoS attacks against victims in the United
States, including large intemet service providers, popular online garning services,
mitigation.
compromising 32,000 devices belonging to a large Canadian victim ISP, which allowed
him in turn to attack targets with bandwidth approximating one Terabit per second.
SCHUCIIMAN claimed responsibility for a test attack using the comprornised Canadian
national level.
others made improvements to the previously described Satori botnet, which they
evolved Satori and Okiru, naming the updated version 'oMasuta." Masuta targeted
vulnerable Huawei and Gigabit Passive Optical Network (GPON) fiber-optic networking
devices, infecting up to 700,000 comprornised nodes. Logs during the Masuta tirne
SCHUCHMAN, Drake, and others, including paying customers of the criminal botnet
scheme. At this tirne, SCHUCHMAN also operated his own distinct DDoS botnet which
SCHUCITMAN was also actively scanning the internet for vulnerable telnet devices fbr
the purpose of identiSing additional devices to incorporate into his active botnets.
combining elements of both Mirai and Satori to exploit devices largely based in Vietnam
improved the botnet, which at this time came to be known as both Tsunami and Fbot.
the Tsunamiffbot time period, the botnet intbcted up to 30,000 devices and was utilized
to attack garning servers as well as servers at Nuclear Fallout. During this development
successfully compromise at least 35,000 of these devices for the purpose of incorporating
thern into the Tsunami/Fbot botnet. Test attacks conducted by SCHUCHMAN and his
systems resulted in estimated attack bandwidths exceeding 100 Gigabits per second
(Gbit/s). At that time, DDoS attacks of that scale could be expected to result in
significant damage.
and Drake developed an unnamed Qbot-derived DDoS botnet. To create this unnamed
compromise the same universe of botnet nodes utilizing overlapping credentials. tsoth
nodes in order to hinder the other's access to the comprornised nodes. SCHUCHMAN
employed tactics such as using the IPTables tool to kill all open ports on the devices, a
tn July 2018, SCHUCI-IMAN was l'rrst interviewed by the FBI. At the time of this
interview in July 2018, SCIIUCHMAN had reconciled with Varnp and resumed working
The purpose of all of the aforementioned activity was to aid and abet DDoS
attacks, which by their nature cause the transmission of code and commands that cause
damage to the victim computers by rendering them inaccessible. At all relevant times,
SCHUCI'IMAN knew and understood that these botnets were was designed to be used,
and was in fact being used, to commit illegal and unauthorized DDoS attacks against
computers in the United States and elsewhere. SCHUCI'IMAN acted with the intent and
goal of aiding, abetting, and furthering these illegal DDoS attacks and causing them to
occur. Further, SCHUCHMAN knew that his infection of the underlying devices was
conducted without the authorization and consent of the device owners in Alaska and
other locations.
Zeta" to converse with co-conspirators, solicit customers, and otherwise support the
conduct continued past his initial appearance and pretrial status hearing in this case.
SCHUCHMAN went so far as to create a new Qbot DDoS botnet variant on or about
October 2018 while on supervised release after having been charged by indictment with
creating and deploying DDoS botnets. SCHUCHMAN also used information gleaned
from discovery in this matter to identiflr the whereabouts of his co-conspirator Drake for
the purpose of facilitating a "swatting" attack that involved a fake 9l I call alleging a
in October 2018.
This Statement of Facts includes those facts necessary to support the defendant's
guilty plea. It does not include each and every fact known to the defendant or to the
government and it is not intended to be a full enumeration of all of the facts surrounding
The actions of the defendant, as recounted above, were in all respects knowing,
voluntary, and intentional, and were not committed by mistake, accident or other
innocent reason.
1. Statutory Penalties
The maximum statutory penalties applicable to the charges to rvhich the defendant
is pleading guilty, based on the fbcts to which the defendant will admit in support of the
The following conditions may also apply and affect the defendant's sentence: l)
pursuant to Comment 7 of U.S.S.G. $ 581.2, the Court may impose an additional fine to
pay the costs to the government of any irnprisonment and supervised release term; 2)
pursuant to 18 U.S.C.$ 3612(f), unless otherwise ordered, if the Court imposes a fine of
more than $2,500, interest will be charged on the balance not paid within l5 days after
the judgment date; 3) upon violating any condition of supervised release, a further term
of imprisonment equat to the period of the supervised release may be imposed, with no
credit tbr the time already spent on supervised release; 4) the Court may order the
defendant to pay restitution pursuant to the l8 U.S.C. $ 3663 and Ll.S.S.G. $ 5E I .l, and
if lS U.S.C. $ 3663A (mandatory restitution fcrr certain crimes) applies, the Court shall
'fhe defendant agrees to pay the entire special assessment in this case on the day
the Court imposes the sentence. All payments will be by check or money order, and are
to be delivered to the Clerk of Court, United States District Court, 222 W.7th Ave. Ilox
Any person convicted of a federal felony offense may lose or be denied federal
benefits including any grants, loans, licenses, fbod stamps, welfare or other fbrms tlf
public assistance. as well as the right to own or possess any firearms, the right to vote, the
right to hold public office, and the right to sit on a jury. if applicable, any defendant who
is not a United States citizen may be subject to deportation frorn the tJnited States
fbllowing conviction for a criminal ol-fense, be denied citizenship, and not permitted to
return to the United States unless the defendant specifically receives the prior approval of
the United States Attorney General. In some circumstances, upon conviction fbr a
criminal offense, any defendant who is a naturalized United States citizen may suffer
E. Restitution
The tl.S. Government has not presently identified a specific restitution amount
owed fbr the offense of conviction. l"he Court will have sole discretion ultimately to
F. Forfeiture
Defendant knowingly and voluntarily waives his rights pursuant to Rule 32.2(a)
and adrnits that Defendant's interest in any property constituting, or derived from,
to 18 U.S.C. $ 982(a)(2XA).
Defendant agrees not to file a claim or withdraw any clairn already filed to any of
which has been or may be initiated by the United States. Defendant further waives the
right to notice of any fbrfbiture prooeeding involving this property, agrees not trt assist
others in filing a claim to said property in any forfeiture proceeding, and will take all
steps as requested by the United States to pass clear title to the above-described property
to the United States, including but not limited to, executing documents and testifying
that assets subject to forfeiture are not sold, disbursed, wasted, hidden, or otherwise made
Defendant understands and acknowledges that the United States is relying upon
the Delendant's truthful asset fbrt'eiture disclosure and cooperation in entering into this
plea agreement. If Defendant fails to cooperate or is untruthf'ul in this regard, the United
The Court must consult the advisory United States Sentencing Commission
Guidelines [U.S.S.G.] as well as the tbctors set lbrth in l8 LJ.S.C. $ 3553(a) when
considering the sentence to impose. The U.S.S.G. do not establish the statutory
pleading guilty. The U.S.S.G. are not mandatory and the Court is not bound to impose a
B. GuidelineApplicationAgreements
The parties have no agreements on any guideline applications unless set fofth
1. Acceptance of Responsibility
If the United States concludes that the defcndant has satisfied the criteria set out in
U.S.S.G. $ 3El .I and the applicable application notes, the United States agrees to
recommend the defendant for a fwo level downward adjustment for acceptance of
responsibility and, if U.S.S.G. $ 381.1(b) applies, to move for the additional one level
adjustment for acceptance of responsibility. Ifl at any time prior to irnposition of the
sentence, the United States concludes that the defendant has failed to fully satisfy the
criteria set out in U.S.S.G. $ 381.1, or has acted in a manner inconsistent with acceptance
of responsibility, the lJnited States will not make or, if'already made, will withdraw this
'I'he United States Probation Office will prepare the defendant's pre-sentence
range under the U.S.S.G. Both the United States and the defendant will have the
The parties are free to recommend to the Court their respective positions on the
appropriate sentence to be imposed in this case based on the stipulated facts set forth in
Section Il.C, any additional facts established at the imposition ofsentence hearing, the
applicable statutory penalty sections, the advisory lJ.S.S.C., and the sentencing factors
In exchange for the defendant's guilty plea and the Court's acceptance of the
defendant's plea and the terms of this agreement, the United States agrees that it will not
prosecute the defendant further for any other offense - now known * arising out of the
subject ofthe investigation related to the charges brought in the Indictment in this case
withdrawn, vacated, reversed, set aside, or rnodified, at any time. in any proceeding, for
any reason, the United States will be free to prosecute the def'endant on all charges arising
out ofthe investigation of this case including any charges dismissed pursuant to the torms
of this agreement, which charges will be automatically reinstated as well as lilr perjury
and false statements. The defendant hereby agrees that he/she waives any def'ense that
A. Trial Rights
Being aware of the following, the del'endant waives these trial rights:
The right to a speedy and public trial by jury on the factual issues
statutory penalties, and any issue afl'ecting any interest in any assets
subject to forfeiture:
The right to plead not guilty or to persist in that plea if it has already
been made;
Ihe right to be presumed innocent and not to suff'er any criminal penalty
doubt;
The right to confront and cross examine witnesses against the defbndant,
The right to remain silent at trial, with such silence not to be used
against the defendant, and the right to testiS, in the defendant's ow'n
behalf; and
B. Appellate Rights
The defbndant waives the right to appeal the conviction(s) resulting from the entry
of guilty plea(s) to the charges set fbrth in this agreement. The defendant further agrees
that if the Court imposes a sentence that does not exceed the statutory maximum penalties
- as set forth in Section II.D above in this agrcement, the defendant waives without
exception the right to appeal on all grounds contained in 18 U.S.C .5 3742 the sentenoe
the Court imposes. The defendant understands that this waiver includes, but is not
limited to, forfeiture (if applicable), terms or conditions of probation (if applicable) or
supervised release, any fines or restitution, and any and all constitutional (or legal)
challenges to delbndant's conviction(s) and guilty plea[s], including arguments that the
statute(s) to which defendant is pleading guilty (is/are) unconstitutional, and any and all
claims that the statement ol'Ibcts provided herein is insufficient to support defendant's
plea[s] of guilty.
within this agreement rvill apply to any l8 IJ.S.C. $ 3582(c) modifications, as well as the
Should the defendant file a notice of appeal in violation of this agreement, it will
dismissed charges, and withdraw any motions for downward departures, or sentences
The defendant agrees to waive all rights to collaterally attack the resulting
of probation (if applicable) or supervised release. and any fines or restitution - the Court
imposes. The only exceptions to this collateral attack waiver are as follows: 1) any
on information not now known to the ilefundant anci whioh, in the exercise of reasonable
diligence, coul{ not be known by the defendant at the time the Court imposes sentence;
Because this is a negotiated resolution of the case, the parties waive any claim for
the award of attorney fees and costs from the other party.
By signing this agreement, the def'endant admits the truth ol'the facts in the
Factual Basis portion of this agreement set forth in Section Il.C. I'he defendant agrees
Ll.S. v. KENNE'I'H CURRIN SCI{I'JCIIMAN
3:18-cr-00154-TMB-DMS Page l9 of 23
Case 3:18-cr-00095-SLG-DMS Document 89 Filed 09/03/19 Page 19 of 23
ヘ ͡
that the statements made by him in signing this agreement shall be deemed usable and
admissible against the defendant as stipulations in any hearing, trial or sentencing that
may follow. The foregoing provision acts as a rnodification, and express rvaiver, of
Federal Rule of Evidence 410 and F'ederal Rule o['Crirninal Prooedure 1l(0, and is
effective upon the defendant's in-court admission to the factual basis supporting the
plea(s). This provision applies regardless of'whether the court accepts this plea
agreement.
Pursuant to Local Criminal Rule 11,2(d)(7) and (8), this plea agreement is
appropriate in that it conforms with the sentencing goals that would otherwise be
applicable to the defendant's case if the defendant had gone to trial and had been
l, Kenneth Currin Schuchman, the del'endant, affirm this docurnent contains all of
the agreements made between me - with the assistance of my attorney - and the United
States regarding rny plea(s). Therc are no other promises, zrssurances, or agreements the
United States has made or entered into with me that have al'lected my decision to enter
any plea of guilty or to enter into this agreement. If there are any additional promises,
assurillces, or agreernents, United States and I willjointly inform the Court in rvriting
case or what sentence the Court may impose if I plead guilty. If anyone, including my
attorney, has done or said anything other than what is contained in this agreement, I will
I enter into this agreernent understanding and agreeing that the conditions set tbrth
herein are obligatory and material to this agreement and that any failure on my part to
fulfill these obligations will constitute a material breach of this agreement. If I breach
this agreement, I agree the United Statos, in its sole discretion, may withdraw frorn this
agreement and may reinstate prosecution against me on any charges arising out of the
investigation in this matter. If my compliance with the tenns of this plea agreement
becomes an issue, at an appropriate hearing, during which I agree any ofmy disclosures
will be admissible, the Court will determine whether or not I have violated the terms of
I understand the Court will ask me under an oath to answer questions about the
understand that I may be prosecuted if I rrake false statements or give false answers and
I have read this plea agreement carefully and understand it thoroughly. I know of
no reason why the Court should find me incornpetcnt to enler into this agreement or to
enter my plea. I cntcr into this agreement knowingly and voluntarily. I understand that
anything that I discuss with my attorney is privileged and conf-tdential, and cannot be
revealed without my permission. Knowing this, I agree that this document will be filed
I am fully satistied with the representation given rne by my attorney and arn
prepared to repeat this statement at the time I stand before the Court and enter rny guilty
plea. My attorney and I have discussed all possible defenses to the charge to which I am
information and issues I have raised to my satisfaction. My attorney has taken the time to
fully explain the legal and factual issues involved in my case to my satisfaction. We have
discussed the statute applicable to my offense and sentence as well as the possible effect
violation of 18 U.S.C. $ 1030, and admit the forfeiture allegation of the Indictment in
their entirety.
DATED:_筆
生 _一
YL.
軍 し 一 一 一 一
¥L重
On behalf of the United States, the following accepts the defendant's offer to plead
guilty under the terms of this plea agreement.
DATED:_
United States of America
United States Attorney